Ransomware Hits Center for Orthopedics in California?

Yes, the Center for Orthopedics and Neurosurgery (CON) in California was hit by a ransomware attack in early 2025. The breach, disclosed in March 2025, encrypted patient files and disrupted operations for several weeks. This article explains what happened, how the attack unfolded, what data was exposed, and what patients should do if they were affected.

Background of the Attack

The Center for Orthopedics and Neurosurgery, a multi-specialty practice with locations in Southern California, reported a ransomware incident to the U.S. Department of Health and Human Services (HHS) in March 2025. The attack was attributed to a known ransomware group, though the specific strain was not officially confirmed. The practice discovered the breach on February 20, 2025, and immediately took its systems offline to contain the spread. This is a standard response, but it also meant that electronic health records (EHR), scheduling systems, and billing software were unavailable for weeks.

Ransomware attacks on healthcare providers have been rising steadily since 2020. According to the HHS Office for Civil Rights (OCR) breach portal, healthcare data breaches involving ransomware increased by over 60% from 2022 to 2023. The CON attack fits this trend, as it involved both data encryption and data exfiltration—meaning the attackers stole copies of patient records before locking the originals.

How the Ransomware Worked

Ransomware typically enters a network through a phishing email, a compromised remote desktop protocol (RDP) connection, or a software vulnerability. In CON’s case, the exact entry point was not publicly disclosed, but the attack followed a common pattern:

• Initial access: Attackers gain a foothold, often through a single employee’s credentials.
• Lateral movement: They move through the network, escalating privileges to access servers with patient data.
• Exfiltration: They copy sensitive files to their own servers—this is the extortion leverage.
• Encryption: They deploy the ransomware, encrypting files and leaving a ransom note with payment instructions.

For healthcare organizations, the disruption is not just financial. When EHRs go down, clinicians lose access to medication lists, allergies, imaging results, and surgical histories. This can delay surgeries, force manual charting, and in worst cases, endanger patient safety. CON was able to continue seeing patients by reverting to paper records and using phone and fax for prescriptions, but the backlog was significant.

Data Exposed in the Breach

According to the HHS breach portal, the CON ransomware attack affected approximately 45,000 individuals. The types of data exposed included:

• Full names and dates of birth
• Social Security numbers
• Medical record numbers and treatment information
• Health insurance policy numbers
• Driver’s license numbers (for some patients)

The presence of Social Security numbers is particularly concerning because it elevates the risk of identity theft and tax fraud. CON began sending notification letters to affected patients in March 2025, offering free credit monitoring and identity restoration services for 12 months. However, patients should be aware that the stolen data may already be circulating on dark web forums.

Timeline of the Incident

Here is the known timeline of the CON ransomware attack, based on the practice’s public statements and HHS filings:

1. February 20, 2025: CON detects unusual activity on its network and shuts down IT systems.
2. February 21–27, 2025: Forensic investigation begins; the practice hires a third-party cybersecurity firm.
3. March 3, 2025: CON confirms it was a ransomware attack and begins notifying law enforcement.
4. March 10, 2025: The practice files a breach report with HHS, listing the number of affected individuals.
5. March 17, 2025: Patient notification letters are mailed out.
6. April 2025: Systems are gradually restored, but some services remain limited for weeks.

It is worth noting that CON did not publicly state whether it paid the ransom. Most experts advise against paying, as it does not guarantee data recovery and encourages further attacks. However, some organizations pay simply to regain access quickly and avoid prolonged downtime.

Impact on Patient Care

The immediate impact was on scheduled surgeries and appointments. CON had to postpone elective procedures for about three weeks. Patients with urgent needs were triaged manually, which led to longer wait times. The practice also had to cancel or reschedule physical therapy sessions, which are often booked weeks in advance.

Beyond the immediate disruption, there are longer-term risks. Stolen medical records can be used for insurance fraud, prescription fraud, or even blackmail. Unlike credit card numbers, medical data cannot be easily changed. A patient’s Social Security number and medical history are permanent, making this type of breach particularly damaging.

For patients, the recommended steps are:

• Enroll in the offered credit monitoring immediately.
• Place a fraud alert or credit freeze on your credit files.
• Monitor your explanation of benefits (EOB) statements for fraudulent claims.
• Change passwords for any portal accounts related to CON.

How to Protect Yourself After a Healthcare Breach

If you receive a breach notification letter, it is important to act, not panic. The first step is to verify that the letter is legitimate—scammers sometimes send fake breach notices to phish for more information. Look for a valid contact phone number and a website you can verify independently.

Next, take advantage of the free credit monitoring. This service will alert you to new accounts opened in your name, credit inquiries, or other suspicious activity. You should also consider a credit freeze, which prevents anyone from opening new credit accounts without your PIN. Freezing your credit is free and does not affect your existing accounts.

Finally, be vigilant about unusual medical bills or insurance claims. If you receive a bill for a service you did not receive, contact the provider and your insurance company immediately. Keep a record of all communications in case you need to dispute fraudulent claims later.

Frequently Asked Questions

Was the Center for Orthopedics and Neurosurgery the only California practice hit by ransomware?
No. Several other California healthcare providers have reported ransomware attacks in the past year, including a large hospital chain in the Bay Area and a dental group in Los Angeles. The healthcare sector is a top target for ransomware because of the sensitive nature of the data and the urgency to restore systems.

What should I do if I think my data was stolen but I didn’t get a letter?
You can check the HHS breach portal, which lists all reported breaches affecting 500 or more individuals. Search for “Center for Orthopedics and Neurosurgery” to see the details. If you are a patient and did not receive a letter, contact the practice directly to confirm whether you are affected.

Can I sue the center for negligence after the ransomware attack?
Under California law, you may have grounds for a lawsuit if you can show that the practice failed to implement reasonable security measures. However, class action lawsuits in healthcare breach cases often settle for credit monitoring and modest compensation. Consult a qualified attorney to discuss your specific situation.

Is it safe to continue using CON for my orthopedic care?
The practice has restored its systems and stated that patient care is back to normal. However, you should weigh the risk of future breaches against the quality of care you receive. If you are concerned, you can ask the practice about the specific security measures they have implemented since the attack.

How long does credit monitoring last after a breach?
Typically, the affected organization offers 12 to 24 months of free credit monitoring. After that period, you will need to continue monitoring your credit yourself or pay for a service. The risk of identity theft can persist for years, so it is wise to remain vigilant even after the free period ends.

Did the attackers release the stolen data?
As of this writing, there is no public evidence that the stolen data was released. However, ransomware groups often wait weeks or months before publishing data if the ransom is not paid. The absence of a leak does not mean the data is safe; it may simply be held for future use or sale.

Related

• Anker 165W vs UGREEN 200W Power Banks: Key Facts
• Nights in the Forest Potion: Ingredients & Recipe
• ODM Meaning in Smartphone Design & Manufacturing

in t | Time since attack (months) | months | 3 | 0 | 120
in d | Days of disruption | days | 21 | 0 | 365
out pct | Disruption severity (%) | % | (d / 30) * 100 | 0